- Freeradius-Users - lists.freeradius.org

New Install
by Cameron Murray 04 Apr '16

04 Apr '16

Guys, First time member and have a slight issue. Fresh Centos 6.7 64bit install and Freeradius installed with a remote MySQL server. Service launches perfectly in debug and daemon however it does not appear to be listening correctly. Netstat -a shows Radius and Radius Account open on * however when I query radius with radtest or radping it sees no data. udp 0 0 *:radius *:* udp 0 0 *:radius-acct *:* Iptables has been disabled and confirmed after reboot. I've tested radping from localhost and the Mysql Server with the same result: radtest test test 192.168.0.250 1812 123456789 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 Sending Access-Request of id 15 to 192.168.0.250 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 192.168.10.251 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 radclient: no response from server for ID 15 socket 3 Is there a secret to make it listen correctly? TIA. Cameron

2 1

chap info freeradius 2.1.12
by khouzam yaghi 04 Apr '16

04 Apr '16

what does the info in the radius log means rarely i am getting this info in the radius log Auth: [chap] rlm_chap: Attribute "User-Name" is required for authentication.

2 1

No EAP response
by TOURE Amidou Florian 04 Apr '16

04 Apr '16

Hi all,I'm configuring a Network Access Control Solution (Packetfence ) but i have a problem to authenticate my users.I hope that someone will be able to help me.-I have a windows 2008 Active Directory for my users -I'm using a cisco 2950 switch to authenticate my users but when connecting a host i get this error on my switch,It seems like the switch cannot reach the server but i'm sure that the radius server ip address is 192.168.10.1 : RADIUS: Retransmit id 4 00:28:11: RADIUS: Retransmit id 4 00:28:13: RADIUS: Retransmit id 4 00:28:15: RADIUS: Marking server 192.168.10.1:1812,1813 dead 00:28:15: RADIUS: Tried all servers. 00:28:15: RADIUS: No valid server found. Trying any viable server 00:28:15: RADIUS: Tried all servers. 00:28:15: RADIUS: No response for id 4 00:28:15: AAA/AUTHEN (3539210218): status = ERROR 00:28:15: AAA/AUTHEN/START (3539210218): no methods left to try 00:28:15: AAA/AUTHEN (3539210218): status = ERROR 00:28:15: AAA/AUTHEN/START (3539210218): failed to authenticate 00:28:15: AAA/MEMORY: free_user_quiet (0x80D4E810) user='Prof-PC\Prof' ruser='Prof-PC\Prof' port='FastEthernet0/2' rem_addr='00-40-D0-67-D0-B1/00-18-BA-9B-E7-82' authen_type=6 service=17 priv=1 This is my swicth configuration here : Building configuration... Current configuration : 2480 bytes!version 12.1no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption!hostname Switch!aaa new-modelaaa group server radius packetfence server 192.168.10.1 auth-port 1812 acct-port 1813!aaa authentication login default local aaa authentication dot1x default group packetfence aaa authorization network default group packetfence!username admin password 0 thegame ip subnet-zero!!spanning-tree mode pvst no spanning-tree optimize bpdu transmission spanning-tree extend system-id dot1x system-auth-control!!!!interface FastEthernet0/1 switchport trunk native vlan 10 switchport trunk allowed vlan 1,10,20,30,40,60,100 switchport mode trunk !interface FastEthernet0/2 switchport access vlan 4 switchport mode access dot1x port-control auto dot1x host-mode multi-host dot1x reauthentication spanning-tree portfast!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24!interface Vlan1 no ip address no ip route-cache shutdown!interface Vlan4 ip address 192.168.4.1 255.255.255.0 no ip route-cache shutdown!interface Vlan10 ip address 192.168.1.5 255.255.255.0 ip helper-address 192.168.10.1 no ip route-cache!interface Vlan20 ip address 192.168.20.1 255.255.255.0 no ip route-cache shutdown!interface Vlan30 ip address 192.168.30.1 255.255.255.0 no ip route-cache shutdown!interface Vlan40 ip address 192.168.40.1 255.255.255.0 no ip route-cache shutdown!interface Vlan50 no ip address no ip route-cache shutdown!interface Vlan60 ip address 192.168.60.1 255.255.255.0 no ip route-cache shutdown!interface Vlan100 ip address 192.168.100.1 255.255.255.0 no ip route-cache shutdown! ip http server radius-server host 192.168.10.1 auth-port 1812 acct-port 1813 timeout 2 key thegame radius-server retransmit 3 radius-server vsa send authentication!line con 0line vty 5 15!!end

3 2

No EAP response
by TOURE Amidou Florian 04 Apr '16

04 Apr '16

Hi all,I'm configuring a Network Access Control Solution (Packetfence ) but i have a problem to authenticate my users.I hope that someone will be able to help me.-I have a windows 2008 Active Directory for my users -I'm using a cisco 2950 switch to authenticate my users but when connecting a host i get this error on my switch,It seems like the switch cannot reach the server but i'm sure that the radius server ip address is 192.168.10.1 : RADIUS: Retransmit id 400:28:11: RADIUS: Retransmit id 400:28:13: RADIUS: Retransmit id 400:28:15: RADIUS: Marking server 192.168.10.1:1812,1813 dead00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No valid server found. Trying any viable server00:28:15: RADIUS: Tried all servers.00:28:15: RADIUS: No response for id 400:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): no methods left to try00:28:15: AAA/AUTHEN (3539210218): status = ERROR00:28:15: AAA/AUTHEN/START (3539210218): failed to authenticate00:28:15: AAA/MEMORY: free_user_quiet (0x80D4E810) user='Prof-PC\Prof' ruser='Prof-PC\Prof' port='FastEthernet0/2' rem_addr='00-40-D0-67-D0-B1/00-18-BA-9B-E7-82' authen_type=6 service=17 priv=1 This is my swicth configuration here : Building configuration... Current configuration : 2480 bytes!version 12.1no service padservice timestamps debug uptimeservice timestamps log uptimeno service password-encryption!hostname Switch!aaa new-modelaaa group server radius packetfence server 192.168.10.1 auth-port 1812 acct-port 1813!aaa authentication login default localaaa authentication dot1x default group packetfenceaaa authorization network default group packetfence!username admin password 0 thegameip subnet-zero!!spanning-tree mode pvstno spanning-tree optimize bpdu transmissionspanning-tree extend system-iddot1x system-auth-control!!!!interface FastEthernet0/1 switchport trunk native vlan 10 switchport trunk allowed vlan 1,10,20,30,40,60,100 switchport mode trunk!interface FastEthernet0/2 switchport access vlan 4 switchport mode access dot1x port-control auto dot1x host-mode multi-host dot1x reauthentication spanning-tree portfast!interface FastEthernet0/3!interface FastEthernet0/4!interface FastEthernet0/5!interface FastEthernet0/6!interface FastEthernet0/7!interface FastEthernet0/8!interface FastEthernet0/9!interface FastEthernet0/10!interface FastEthernet0/11!interface FastEthernet0/12!interface FastEthernet0/13!interface FastEthernet0/14!interface FastEthernet0/15!interface FastEthernet0/16!interface FastEthernet0/17!interface FastEthernet0/18!interface FastEthernet0/19!interface FastEthernet0/20!interface FastEthernet0/21!interface FastEthernet0/22!interface FastEthernet0/23!interface FastEthernet0/24!interface Vlan1 no ip address no ip route-cache shutdown!interface Vlan4 ip address 192.168.4.1 255.255.255.0 no ip route-cache shutdown!interface Vlan10 ip address 192.168.1.5 255.255.255.0 ip helper-address 192.168.10.1 no ip route-cache!interface Vlan20 ip address 192.168.20.1 255.255.255.0 no ip route-cache shutdown!interface Vlan30 ip address 192.168.30.1 255.255.255.0 no ip route-cache shutdown!interface Vlan40 ip address 192.168.40.1 255.255.255.0 no ip route-cache shutdown!interface Vlan50 no ip address no ip route-cache shutdown!interface Vlan60 ip address 192.168.60.1 255.255.255.0 no ip route-cache shutdown!interface Vlan100 ip address 192.168.100.1 255.255.255.0 no ip route-cache shutdown!ip http serverradius-server host 192.168.10.1 auth-port 1812 acct-port 1813 timeout 2 key thegameradius-server retransmit 3radius-server vsa send authentication!line con 0line vty 5 15!!end

3 3

Freeradius Max-Daily-Session in custom authentication
by Polarix 01 Apr '16

01 Apr '16

Actually i have AAA by mysql and everything work fine. Especially the use *Max-Daily-Session*attribute to disconnect the user after 10min (600sec) connection. I recently changed the way authenticazione using a custom php script. In sites-enabled/default file: authorize{ update control { Auth-Type := `/usr/bin/php -f /etc/raddb/yourscript.php '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}'`} In /etc/freeradius/users: DEFAULT Auth-Type = AcceptExec-Program-Wait = "/usr/bin/php -f /etc/raddb/attributes.php '%{User-Name}' '%{User-Password}' '%{Client-IP-Address}'" In attributes.php: <?php $User = $argv[1]; $Pass = $argv[2]; $Ip = $argv[3];if ($User == "test") echo "Max-Daily-Session:=600";?> It seems that the server does not care about the Max-Daily-Session attribute and does not send the Packet of Disconnect. What changes between mysql and custom authentication?

2 4

audispd stopping radiusd due to memory violation
by Christopher Michael Allison 01 Apr '16

01 Apr '16

I am seeing this happen on one of our radius servers. We are running FreeRADIUS 3.0.11. This started happening more frequently on one of our radius. Yesterday has been the most it has done it. It was 3 times in like a 6 hour period. We had this issue when I first upgraded our servers to 3.0.11 but I found another avenue that this was due to and it was that the MozNSS compile openldap libraries were causing this issue. I have since fixed that I have compiled openldap based upon openssl and this has stopped happening on all our other servers. This one server keeps dying because of a memory violation. The error message follows: audispd[902]: node="radius-server-hostname" type=ANOM_ABEND msg=audit(1459467717.181:189187): auid=4294967295 uid=977 gid=2010 ses=4294967295 subj=system_u:system_r:unconfined_service_t:s0 pid=40239 comm="radiusd" reason="memory violation" sig=11 Thanks, CHRISTOPHER ALLISON Network Engineer I Information Technology Mail Code 4622 625 Wham Drive Carbondale, Illinois 62901 chris.m.allison(a)siu.edu<mailto:%20chris.m.allison@siu.edu> M - F 7:30 AM - 4 PM P: 618 / 453 - 8415 F: 618 / 453 - 5261 INFOTECH.SIU.EDU<http://infotech.siu.edu/> [http://asset.siu.edu/_assets/images/email_sig/SIU_email_2line.gif] "Choose a job you love, and you will never have to work a day in your life." Confucius

3 2

OCSP URL format
by Alex Sharaz 01 Apr '16

01 Apr '16

Quick question about OCSP URLs. When overriding the cert specified OCSP URL, can you specify more than one just in case a server dies for example? Just been off site and our F5 that load balances requests to our OCSP service decided not to forward them hence the only way to connect to eduroam was to delete the TLS profile and use PEAP. Talking to all the individual OCSP servers worked just fine. Rgds Alex

5 11

Wiki updates - Debian instructions
by Matthew Newton 31 Mar '16

31 Mar '16

Just a heads-up here as I know people often point at the Debian building instructions on the wiki. I've done a little reorganising. The main "Build" page has been getting rather long, so I've separated the Debian build instructions off into the (already existing) "Debian" page. So Debian and Ubuntu now point there: http://wiki.freeradius.org/building/Build points to http://wiki.freeradius.org/building/Debian Essentially, the cluebat for "I'm using 2.1.12 on Debian" should now be http://wiki.freeradius.org/building/Debian The build instructions now also include mk-build-deps to automatically install the build-deps, rather than using apt-get build-dep, which actually installs the build-deps for the version in the Debian repository (probably 2.1.12...) rather than (hopefully) 3.x. And I've removed some prehistoric stuff regarding OpenSSL from 2.1.8 or so. I've also taken the liberty to expand that page to include instructions on building Debian Samba packages that include the libwbclient patches to enable direct communication with winbind. This is required because the latest version of Samba in Debian Jessie is still less than 4.2.1, but is now much easier than it was with Samba 3 in Wheezy. I've tested most combinations of building from the instructions, but shout (or correct them) if it doesn't work for any particular situation. If anyone has Oracle and wants to update the section on building with support for that then please do so. It links to a remote site that is now five years old. I don't have a copy of Oracle (hey, it's not free) so can't update that. At some point I plan to add instructions for building clean packages using sbuild as well. The current instructions are fine for installing on the same machine it was built on, but not good for distribution. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 3

Issue with building FR 3.0.x packages on Ubuntu 14.04
by Alex Sharaz 31 Mar '16

31 Mar '16

This has been with me for a while. When ever I try building packages I end up with *dh_installdirs install -d debian/freeradi* *us/var/tmp/freera**dius-server-3.0**.x-290316/debia**n/freeradius.di**rs: 1: /var/tmp/freera**dius-server-3.0**.x-290316/debia**n/freeradius.di**rs: usr/lib/freerad* *ius: not found/var/tmp/freera**dius-server-3.0**.x-290316/debia* *n/freeradius.di**rs: 2: /var/tmp/freera**dius-server-3.0**.x-290316/debia* *n/freeradius.di**rs: var/log/freerad* *ius: not founddh_installdirs: problem reading debian/freeradi* *us.dirs:make: * [install-arch] Error 127dpkg-buildpacka**ge: error: fakeroot debian/rules binary gave error exit status 2* Eventually gave up and went to talk to helpful linux systems person upstairs. Here's what he said ..... The only changes I made were to remove execute permission from a lot of the files in debian/, which seems to affect how the dh suite treats the files. That's probably dependent on the version of the build utilities, but they shouldn't have random execute permissions on things, really. *chmod -x debian/*.{docs,**examples,instal**l,lintian-overr* *ides,manpages,p**ostinst,postrm,**preinst,prerm}* *chmod -x debian/README.** Those are the changes after unpacking; then I literally did *fakeroot dpkg-buildpacka**ge -b -us -uc* ..... then another message saying ... ..and here's the change to the build tools which made this all break! https://anonscm.debian.org/git/debhelper/debhelper.git/commit/?h=9.20120115… If the FR folk want to fix this, they should either (a) fix the file permissions under debian/ as mentioned above, or they should change debian/compat to "8" instead of "9"..... I've just changed debian/compat to "8" and ....... package files built successfully on Ubuntu 14.04 AND on my Raspberry Pi 3 running Ubuntu MATE

5 7

Multiple SQL DB for different authentication sources
by Max .M 31 Mar '16

31 Mar '16

Hi, i'm just wondering if what I have in mind is feasible. If it is, i'd really appreciate being pointed to the right direction or documentation :) I need to have 3 different SQL databases which will be used for authentication of different sites. How can I use a particular SQL DB for a particular Client ? E.G. : 1 db would be used for guest authentication and another db would be used for other internal authentication stuff. Thanks a lot !

3 3